What is the best way to upload a file securely?

My client is a .NET Desktop Application and server is Apache Tomcat running JSP Files, running on a Linux OS.

  • 5
    "Securely" against what threats and what attackers? Do you trust the user? Do you trust the client computer? Do you trust the network connection? Do you trust the server? Do you trust certificate authorities? Do you trust yourself? – Philipp Jul 18 '16 at 15:02
  • OWASP has some protection and prevention methods here – user2320464 Jul 18 '16 at 16:08
  • Securely as against hackers, malacious servers and so on. User has credentials to login and upload. however the same credentials can be used to upload a file to a malacious server.. – Sheldon Cooper Aug 10 '16 at 14:27

You can normally upload the file using standard HTTPS way, however, exposing application server for uploads is always very risky. Especially if the application server has a lot of libraries built-in and so on. So ideally:

  • Create dedicated Tomcat instance just for file uploads with minimum set of libraries
  • Enable HTTPS on it and disable HTTP, harden HTTPS settings so it's using only latest protocol versions
  • Create user certificate which is used to authorize user to connect to the server
  • Create the username and password for each user
  • Now you can upload via HTTPS to tomcat controller any file, you can make it by using binary form to not consume too much bandwidth
  • If you have more of the infrastructure, you can use HTTPS -> HTTP proxy, e.g. in AWS, this makes things easier

On top of that, you can encrypt the file itself. If it's .NET application, it could be dedicated (per app instance, e.g. per customer) pre-shared symmetric key which is not stored on the destination server, so the file is copied from the upload Tomcat instance to another, isolated instance where it is decrypted. Regarding pre-shared keys, it's not the best way, so you can use another Tomcat instance as Key Server. Having client certificate already, you can connect to Key Tomcat Instance and request one-time symmetric key, and the decrypting Tomcat Instance will re-request this key during decryption.

You can bypass the extra upload server if you trust your Main Tomcat. However, using HTTPS and Key Server with encryption is really recommended if upload needs to be secure. Also, the stored file might remain encrypted and the Main Tomcat server might not need / be able to query the Key Server at all.

This way, if your upload server gets compromised, the files are unreadable. If your key server gets compromised, the files are not readable either. Reducing the attack surface is the main thing. Use cheap Tomcat hosting to achieve that. Use JRE8 with G1GC to reduce memory usage. Use streams and don't load files into RAM.

See the diagram: Example Secure Upload

| improve this answer | |
  • You seem to know what you are talking about. But before you invest so much effort into an answer you might want to wait for the question author to clarify what they mean with their question. – Philipp Jul 18 '16 at 16:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.